Company Data on the Dark Web: The Price of an Attack and the Trail of Leaks

The dark web is a part of the internet that standard search engines do not show and that is reached with special tools, where stolen data and cybercrime services are bought and sold. Companies' employee emails, passwords and customer data often start circulating there after a breach. Most IT managers only find out after an attack has happened. In this article we look at attack prices on the dark web, how leaked data is used and why dark web monitoring matters.

The price of a cyber attack on the dark web

According to dark web prices compiled by TechRepublic in May 2026:

• A 24-hour DDoS attack on an unprotected website: from $45
• A full identity package for one person ("fullz"): between $20 and $100
• A passport scan: about $100

Prices vary by marketplace and with law enforcement operations. These figures cover small-scale attacks; ransomware groups price their services very differently. Even so, the picture is clear enough: attacking is cheap, defending is expensive, and recovering is far more expensive still.

How is leaked data used?

If an employee's email address and password leaked in another site's breach, attackers can use that information for:

• Credential stuffing: if the same password is used on corporate accounts, the attacker walks straight in.
• Targeted phishing: leaked details are used to craft convincing messages tailored to the employee.
• Executive impersonation: executives' personal details make CEO fraud scenarios more convincing.
• Ransom and extortion: if customer data has leaked, the organisation can be threatened directly.

Wherever there is data, there is a target: the BreachForums case

BreachForums was one of the largest underground forums where stolen data and cybercrime activity were shared. In January 2026 the forum's own user database leaked, exposing around 324,000 user records. The leaked data included usernames, email addresses, IP details and activity logs.

The lesson: every database that holds data is a potential target, whoever it belongs to. If even criminals' data leaks, the chance that an ordinary company's data leaks one day is far from low.

What is dark web monitoring?

Dark web monitoring is the continuous tracking of whether your organisation's domains, email addresses and other identifiers appear in dark web marketplaces, forums and leak databases. When a match is found, the organisation is alerted and can take the necessary steps.

The benefits of dark web monitoring:

1. Early warning: a leaked password can be changed before it is used.
2. Risk visibility: you know which employees' details are in circulation and can give them priority support.
3. Support for awareness: telling employees "your details have leaked" is the most concrete way to explain the risk of reusing passwords.
4. Incident response: detecting a leak involving customer data early buys time for data protection notification duties such as those under the GDPR.

What to do when a leak is detected

1. Change the passwords of the affected accounts immediately.
2. Check whether the same password is used on other accounts.
3. Make sure MFA is turned on for the affected accounts.
4. Warn the employees concerned about the risk of targeted phishing.
5. If customer data is affected, assess your data protection notification obligations.

Frequently asked questions

---
InfoLore's dark web monitoring service tracks your organisation's digital footprint and detects leaks early. Get in touch to find out where you stand today.